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Abstract 

Program Managers (PM) can protect program 
resources and improve chances of success by 
anticipating, understanding and managing risks. 
Understanding the range of potential risks helps 
one to avoid or manage the risks. A PM must 
choose which risks to accept to reduce fire fighting, 
must meet the expectations of stakeholders 
consistently, and avoid falling into costly “black 
holes” that may open. 

A good risk management process provides the 
PM more confidence to seize opportunities save 
money, meet schedule, even improve relationships 
with people important to the program. Evidence of 
managing risk and sound internal controls can 
mean better support from superiors for the program 
by building a trust and reputation from being on top 
of issues. Risk managers have an obligation to 
provide the PM with the best information possible to 
allow the benefits to be realized (Small Business 
Consortium, 2004). 

The Institute for Chartered Accountants in 
England and Wales “sees very important benefits 
for companies in providing better information about 
what they do to assess and manage key business 
risks. Such information will: 

• provide practical forward-looking information: 

• reduce the cost of capital; 

• encourage better risk management; 

• improve accountability for stewardship, investor 
protection and the usefulness of financial reporting. 
We are particularly convinced that enhanced risk 
reporting will help listed companies obtain capital at 
the lowest possible cost (The Institute of Chartered 
Accountants in England & Wales, June 2002).” 

Risk managers can take a significant role in 
quantifying the success of their department and 
communicating those figures to executive 
(program) management levels while pushing for a 
broader risk management role. Overall, risk 
managers must show that risk management work 
matters in the most crucial place — the bottom line — 
as they prove risk management can be a profit 
center (Sullivan, 2004). 


Objective 

Risk managers have an opportunity to provide a 
valuable service to their programs, projects, or 
other business enterprise entity by effectively 
communicating information upon which managers 
can act. Providing information in a manner that 
PMs understand and that focuses decision making 
and follow on actions for the greatest benefit should 
be the goal of all risk management professionals. 
Providing the information in a manner that 
maximizes the probability of clear PM 
understanding is necessary. 

This paper is written to provide risk management 
professionals helpful guidance on presenting risk 
information to PMs or other managers. 

Literature Review 

A limited literature review provides a wealth of 
information, definitions, case studies and advice for 
managing risk. Much of the information comes 
from the industry sector and is related to financial 
risk and property loss protection via insurance 
companies and their risk reduction activities 
performed for clients. However, the information is 
as applicable in the program and project world as it 
is with respect to the financial health of a business 
enterprise. The terms business, company, 
organization, program, etc. are used 
interchangeably for purposes of this paper. 

Introduction 

A British Small Business Consortium reports that 
many believe that early warning of potential issues 
can help prevent crises and the associated 
negative impacts. The public now holds 
government, industry and academic entities even 
more accountable for environmental, social, and 
economic activities but few have programs to 
systematically identify and evaluate these particular 
risks (Small Business Consortium, 2004). 

Organizations must develop a strategy for risk 
reporting that responds to the needs and views of a 
wide range of stakeholders. Providing information 
on risk is a vital factor in helping organizations 
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succeed. (The Institute of Chartered Accountants 
in England & Wales, June 2002). 

Any organization needs to ensure that it has a 
proper continuous risk management process, 
generally involving the following steps: 

• identify, rank and source the inherent risks in the 
strategy 

• select the appropriate risk management 
approaches and transfer or avoid those risks that 
the organization is not competent or willing to 
manage; 

• implement controls to manage the remaining 
risks; 

• monitor the effectiveness of risk management 
approaches and controls; 

• learn from experience and make improvements. 
(The Institute of Chartered Accountants in England 
& Wales, June 2002). 

Risk managers must ensure the risk 
management process is coordinated and 
management is fully informed by making sure 
proper availability and flow of information to all the 
steps takes place. Ideally internal information flows 
are designed to satisfy both internal and external 
reporting requirements and are not “additional 
burden” over other business processes. Many 
management actions will be undertaken during the 
normal course of business. Normally a range of 
management actions will be undertaken to address 
the body of identified risks (The Institute of 
Chartered Accountants in England & Wales, June 
2002). 

In order to provide the PM with needed data, risk 
measurements must be designed and executed. 
There is no standard way in which to measure risk. 
Programs that are better at measuring risk will be 
better at allocating capital internally and deciding 
on the most cost-effective way to manage a risk - 
for example, by transfer or control. There are a 
variety of measures of risk, such as: 

• accounting measures, such as contingencies, 
provisions, expected values, discounted cash flow 
valuations; 

• non-accounting performance measures, including 
external data; 

• sensitivity analysis of the effects of changes in 
key variables on both accounting and non- 
accounting measures; 

• value at risk related to accounting measures (The 
Institute of Chartered Accountants in England & 
Wales, June 2002). 

Such risk information can be used to further 
analyze some types of risk: 


• Measures of concentration, reliance on particular 
customers or suppliers can be an indicator of risk. 

• Trend analysis, which provides information about 
trends and how they compare to management’s 
expectations and plans, can be useful in 
demonstrating the effect of changes in gross risks 
or the effect of management’s actions to mitigate 
risk. 

• Benchmarking to similar entities can be important 
where competitive pressures are a major source of 
risk. Managing risks better than a competitor can 
lead to a crucial competitive advantage. Although 
accounting information is likely to be highly relevant 
in reporting on many risks, other risks require a 
different approach (The Institute of Chartered 
Accountants in England & Wales, June 2002). 

Safety aspects of risk include accidents that 
result in costs for lost productivity, human suffering 
and related expenses, loss of capital equipment, 
delays of schedule, etc. Management decisions 
will be based on organizational strategies and risk 
tolerance posture and are likely to be focused on 
the accounting type information as a bottom line, 
but focusing on leading indicators such as accident 
rates, compliance with System Safety requirements 
as programs mature, etc. might give the PM the 
early warning information needed to avoid those 
potential costs. 

This paper begins with a discussion of PM or 
other manager needs related to risk management 
information, followed by discussions of how data 
can be collected, packaged, and presented. 

Finally, a discussion on follow up is provided. 

What Information do Program Managers Need? 

Unfortunately in the risk management world, 
only when problems arise can tangible results be 
seen, so risk managers must show what might 
have happened and the losses that would have 
resulted without actions taken. In a corporate 
sense, one might consider that situation to be 
profit-making in reverse — the negation of 
detrimental actions that allows a company to 
prosper. 

One must first determine how risk management 
is linked to the concerns of program management. 
According to a survey of CFOs, business 
executives worry about: 

• achieving financial targets 

• maintaining liquidity 

• business strategy 


2 


• mergers and acquisitions 

• balancing risk and reward 

• rating agencies 

• financial analysts 

• internal and external stakeholders 

Most of these worries, or a reasonable 
equivalent, can easily be extended to the Program 
Manager since, depending on the type 
organizational home, the PM’s successes affect a 
bottom line of performance in the same or similar 
ways. The message is that for a risk manager to 
be effective in communicating risk information, the 
information needs to be linked to the concerns of 
the PM (Sullivan, 2004). 

Each risk manager must investigate how these 
theories of executive concerns specifically apply to 
his or her company. In addition, the risk manager 
needs to consider how risk management activities 
affect the concerns. Events and risk 
management’s response to them must then be tied 
to the key performance measures and metrics of 
the company. Some leading companies link risk 
management with strategic planning to enhance 
their competitive advantage and increase overall 
business performance. The risk manager should 
step up to this interest (Sullivan, 2004). 

So, by understanding a PM’s perspective, the 
risk manager can tie the risk management activities 
to those needs and to program performance 
measures and metrics, such as customer 
satisfaction and tying all results to those 
measurements. 

The most important thing is making sure risk 
managers have the “metrics that matter,” i.e., ones 
that are important to the business, expressed in 
terms of the business, driven by business goals 
and based on objective measures. According to 
Stevens (Sullivan, 2004), strategic information, 
provides the following: 

• an understanding of risk by identifying, quantifying 
and prioritizing risk. 

• influences the organization and leadership as a 
catalyst to change behavior. 

• aligns risk-taking to an organization’s strategic 
direction. 

• reduces costs by clearly communicating issues 
and impacts of risk management activities. 


The manager’s needs must be satisfied by the 
process established such that the process results in 

■ identifying the principal risks and, in qualitative 
terms, the nature of the potential impact on results 
and of trends and factors underlying the business 
that have affected the results but are not expected 
to continue in the future; and 

■ known events, trends and uncertainties that are 
expected to have an impact on the business in the 
future (The Institute of Chartered Accountants in 
England & Wales, June 2002). 

How do Risk Managers Obtain the Necessary 
Information? 

Although managing risk has always been 
considered important, it has generally been 
managed as a separate function. A company-wide, 
integrated procedure in place to monitor and control 
risks is important (The Institute of Chartered 
Accountants in England & Wales, October 2002). 

A good risk management program must be an 
integral part of an organization’s overall strategy 
and must be structured to obtain the needed 
information. Again, The Institute of Chartered 
Accountants in England & Wales provides 
guidance, “As a backcloth for communicating about 
risk, companies should communicate their overall 
strategy and their process for developing the 
strategy. Then: 

• companies should be open about the risks 
involved in implementing their strategy, so that 
there is a common appreciation of what they are; 

• directors should communicate clearly what 
actions they are taking to manage these risks, 
providing sufficient information to allow 
stakeholders to make a judgment about the risks 
being undertaken; 

• when reporting performance, directors should 
report promptly and in a balanced way (The 
Institute of Chartered Accountants in England & 
Wales, June 2002).” 

The Small Business Consortium, while 
acknowledging that there are many ways of 
analyzing risks, provides a basic structure for 
designing a program that obtains the appropriate 
information about risks. The structure must provide 
for allocating risk into categories - important in the 
drive to achieve comparability in risk reporting. 

Information should be organized electronically 
and compared on a consistent basis. However that 
comparability can only be achieved by the 
widespread use of common classification schemes. 
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Further development of useful classifications is a 
prerequisite for consistent risk reporting but 
reporting against every risk on a standard checklist 
is counterproductive. The aim is use of a common 
menu to report on the most relevant risks. Risk is 
further analyzed between operations, 
empowerment, information processing technology, 
integrity and financial. Prioritization in the choice of 
what to report is a key element in successful risk 
reporting while a boilerplate list will not deliver the 
information required (Small Business Consortium, 
2004.) 

• List the risks that are significant for the 
program. 

• Focus on the important ones and set up clear 
management policies and controls. 

• Think about risk comfort levels and establish 
limits. 

• Identify simple performance markers and watch 
the information feedback. 

• Train directors to consider the wider risks. 

• Designate responsibilities. 

• Involve employees and suppliers in discussion 
about risk and risk actions. 

• Keep it simple. 

The reporting process “doesn’t have to be time 
consuming or complicated. It’s basically common 
sense (Small Business Consortium, 2004).” 

Risk management data must be reliable. 

Sullivan states, “Most importantly, risk management 
data provides an argument only as strong as its 
reliability.” Some managers have developed 
methods of evaluating metrics to help ensure 
reliability. Dan Kugler, the risk manager at Snap- 
on Inc., evaluates five qualities in the metrics he 
uses — measurable, clear owner, directly related to 
important needs, resistant to actuarial analysis and 
controllable by the company. Because risk 
managers cannot assume the source of the data is 
responsible for its quality they must adhere to data 
management best practices, including monitoring 
feedback from the data and tracking its 
effectiveness (Sullivan, 2004). 

Kenneth Krenicky, Senior Vice President, Risk 
Management, Aventis, relates the importance of a 
team approach to risk management processes, “No 
one person can be the risk manager for the whole 
corporation because there is risk in everything. 

One of our missions is to put a risk mindset into the 
company, but we realized that you cannot ask any 
one department or any one person to know all 


areas of business. Now we have a process in 
place where people can talk openly and in a sense, 
anonymously. So we can simply say “the 
committee recommends” or “the workshop 
recommends,” not “Joe Smith recommends.” That 
way things can really be discussed and get across 
the silos in a company (Risk Management 
Magazine, October, 2004). 

How Should Presentation Information be 
packaged? 

The most essential point: keep it simple. Whether 
presented in text, graphs or photographs, a few key 
points that are well developed and well supported 
are more likely to have a greater impact. As Gary 
Kilburg, director of risk management at the 
Whirlpool Corporation suggests, senior executives 
need clarity, context and consistency (Sullivan, 
2004). 

Based on this comment, one might conclude 
that while packaging might be important, it is 
perhaps that packaged that is more important. The 
presenter must endeavor to provide the details the 
PM needs, while not allowing the message to be 
obscured by excess detail, trivial information not 
related to analysis and management of the key 
risks, or “over-cooked” creativity in presentation 
media chosen. Clearly the presentation packaging 
must be consistent with the organization’s culture 
and any specific requirements that might exist. 
Distractions caused by a unique approach to 
presentation rather than clear presentation using 
familiar techniques might be detrimental. 

A suggested approach would be, using standard 
and commonly accepted formats and media, 
present a brief introduction, an explanation of the 
agenda to be followed, and go to the key issues, 
including rationale and recommendations as 
appropriate for the forum. 

How Should Risk Information be Presented? 

Cindy Stevens, director of treasury and risk 
finance at Labor Ready, Inc. in Tacoma, 
Washington, suggests risk managers use what she 
calls “strategic information,” to deliver the message 
in the metrics with which executives are already 
dealing and gear that information toward analytical 
tasks (Sullivan, 2004). 

Managers are interested in “hard data” that 
represents “hard facts,” such as earnings per share 
or cash flow impact (Sullivan, 2004). The PM 
needs to know potential schedule threats, hazards 
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that might become manifest, cost threats, and 
mitigation opportunities available. Direct 
presentation of the issues can help avoid 
misunderstandings of facts and probabilities and 
consequences of risks becoming problems. 

Gary Kilburg, director of risk management at the 
Whirlpool Corporation suggests that senior 
executives need clarity, context and consistency 
(Sullivan, 2004). Kilburg customizes reports for 
different audiences — treasury, CFO and the board 
of directors, operations and manufacturing leaders, 
and worldwide controllers and regional CFOs — and 
also emphasizes the human interaction that 
precedes and follows the results presented on 
paper. 

Key questions could be asked to determine of 
managers are getting the right information: 

• Does the current management information 
provided give sufficient early warning of potential 
problems? 

• Is there awareness of trigger events, or frequency 
of events, for each significant risk which should 
alert management to a potentially significant issue? 

• Does potential news travel quick enough and is 
action taken quickly enough? (Centre for Business 
Performance, 2004). 

Some present and former senior managers at 
NASA were consistent in stating how they preferred 
to get risk information. The consensus was that 
risk information needs to be timely, accurate, and 
truthful. Further, David King, Director, Marshall 
Space Flight Center recommends that the risk 
manager or presenter be able to “ask the next 
question.” In the sense of the presentation of risk 
data, that means to be abie to look at the data 
being prepared for presentation and going beyond 
the surface to identify questions that the information 
might generate. Ask the “next question” that gets 
at the root of why the threat exists and why the 
recommended course of action is thought to be 
effective and within the organization’s strategy 
(based on personal conversations and viewing 
televised panel discussions). 

Certainly, allowance for open discussion with the 
PM and others present must be included. 
Anticipation of discussion comments can help the 
presenter to include comments within the 
presentation, either as primary presentation or 
backup material, or to mentally prepare answers for 
potential questions. In any case, to the risk 
manager’s best ability, the information presented 
must include the key hard facts that can lead 
management to making the correct decisions if the 


additional discussions do not materialize as 
imagined. 

How Should One Follow Up? 

Follow up on risk management information and 
decisions is critical. Kilburg believes strongly in this 
last point; follow up in person. Kilburg arranges 
face-to-face meetings, quarterly international risk 
conference calls, operations reviews and plant and 
office visits worldwide. Reports also need not be 
only once-a-year occasions. Dan Kugler, for 
example, makes presentations on a semiannual, 
bimonthly and monthly basis, “Whether on paper or 
in person, continually delivering the message of risk 
management’s contribution maintains its reputation 
for saving money for the bottom line (Sullivan, 
2004).” 

Conclusion 

Risk management is a response to the fact that 
the world has become more risky, i.e. dangerous, 
according to Michael Power. “Claims for the 
benefits of risk management are numerous. In 
financial services organizations, risk management 
has enabled a new focus on asset and earnings 
quality. In the corporate sector more generally, risk 
management has become perceived as integral to 
business strategy and to value creation. Risk 
management has been shifted from a back-office, 
transaction-veto defensive role into a fundamental 
part of the business model. ... And in all these 
settings it is widely accepted that the managed 
taking of risks is essential to progress and the 
creation of value - with the exception of extreme 
enthusiasts for the precautionary principle (Power, 
2004).” 

Power concludes, “A growing activism and 
individualism in the environments of organizations, 
amplified by political pressures, has resulted in an 
intensification of internal control practices. From 
this broad point of view, despite the positive talk, 
the new wave of risk management can be regarded 
as a defensive reaction to an increasingly 
demanding environment (Power, 2004).” 

Regardless of opinion on why risk management 
exists or has come into heightened importance of 
late, facts support the conclusion that risk 
management, when systematically and consistently 
applied, does provide benefits to organizations. It 
is incumbent on the risk managers to ensure 
provision of adequate, needed information to 
management. The following comments indicate 
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how successful risk managers improve the success 
of their organizations by showing the value of their 
contributions. 

Ellen Vinck, the vice president of risk 
management and benefits at United States Marine 
Repair, Inc., has risen to upper management at her 
organization and has made risk management such 
a fixture that company executives expect to hear 
routinely how much money the department is 
saving the organization. She says that she never 
asked permission to push things forward; she took 
the initiative and just did it (Sullivan, 2004). 

Richard Sarnie, Director, Risk Management, 
Insurance and Security, Engelhard Corporation 
says, “At heart, I’m a safety engineer by training 
and by trade, so one of the first things I look at is 
how you can prevent a problem from happening. As 
a safety engineer, I used to hate when the 
insurance inspector used to show up at the plant — 
Hector the Inspector, Charlie Checklist, whatever 
you want to call him. He didn’t know the company, 
he didn’t know the plant and he spent the whole 
day walking around telling me things I already 
knew. I totally changed that process at Engelhard. 
We still have outside service providers show up at 
the plant, but they are certified safety professionals 
hand-picked by me, and they assess, they assist 
and they help the plant. That has generated a lot of 
positive feedback. Let’s face it: the people running 
these plants are in charge of multimillion-dollar 
operations and know what they are doing. Why do 
we have to treat them like children? We go in there, 
provide them with a resource and now, they pick up 
the phone and call me if they have an issue or a 
problem and they ask for me to send in somebody 
from loss engineering. They’re asking for 
assistance before there is a problem. You know 
you’re successful when your customer, the plant, is 
asking for more help, not less (Risk Management 
Magazine, October, 2004).” 

According to Jonathan Lawlor, Corporate Risk 
Manager, Louis Dreyfus Holding Company Inc., 
“Success stories work and you get them by 
reducing costs or reducing the amount of time 
needed to solve problems. If you can do that, your 
people will be welcome every day (Risk 
Management Magazine, October, 2004).” 

James Duggan, Vice President - Risk 
Management, Security & Corporate Services, Coty 
Inc., makes the point that “once you give some 
decent advice and have some good, solid 
reasoning for that advice, they start coming to you 
all the time (Risk Management Magazine, October, 
2004).” 


“Risks” can mean that realized goals are very 
different from intended, desired goals. Therefore, 
as risk can have a large impact on performance, it 
should be of prime concern to managers. A risk- 
based approach can make an organization more 
flexible and responsive to fluctuations making it 
better able to satisfy customers’ ever-changing 
needs in a continually evolving environment 
(Centre for Business Performance, 2004). 

Effective risk management and internal control 
can be used to manage change, to involve all levels 
of people in the organization in meeting its 
business objectives. Therefore, the proper focus 
on risk management and internal control can result 
in considerable benefits being gained (Centre for 
Business Performance, 2004). 

The Author 

Charles Herbert Shivers, PhD, P.E., CSP. Dr. 
Shivers is Manager, Engineering Policies and 
Programs Office, of the NASA Marshall Space 
Flight Center Engineering Directorate and is the 
NASA Technical Authority for System Safety 
Engineering. Dr. Shivers has over 25 years 
experience in Industrial and Systems Safety for the 
Department of the Army, the Tennessee Valley 
Authority and NASA. Dr. Shivers earned degrees 
from Auburn University, Bachelor of Industrial 
Engineering; Texas A&M University, Master of 
Engineering, Industrial Engineering; and University 
of Alabama in Huntsville, Doctor of Philosophy, 
Industrial and Systems Engineering and 
Engineering Management. He is a member of 
Alpha Pi Mu and Tau Beta Pi honor societies. Dr. 
Shivers is a registered Professional Engineer in 
Alabama and a Certified Safety Professional. He is 
a member of the System Safety Society and the 
Tennessee Valley Chapter, a member of the 
American Society of Safety Engineers and of the 
National Society of Professional Engineers. His 
publications and presentations include: 

“The Importance of Safety: The Vision for Space 
Exploration," presented to the 73 rd Annual Meeting 
of the National Board of Boiler and Pressure Vessel 
Inspectors, Nashville, TN, May 10, 2004, 
representing the NASA Marshall Speakers Bureau. 

"Configuration and Data Management and the 
System Safety Professional," paper presented at 
the 19th International System Safety Conference in 
September 2001 and published in the Proceedings. 


6 



"Self-Directed Work Teams and Safety 
Performance," Professional Safety, July 1999. 

"Halos, Horns, and Hawthorne: Potential Flaws in 
the Evaluation Process," Professional Safety, 
March 1998. 

"Self-directed Work Teams and Likert’s System 4: 
Monitoring and Identifying Interventions for 
Improved Performance," Doctoral Dissertation, 
University of Alabama in Huntsville, 1997. 

Many presentations on Industrial Safety, Risk 
Management, and Engineering Ethics to 
professional societies and NASA work groups. 

References 


Laura Sullivan, “Part of the Profit: Risk 
Management and the Bottom Line,” Risk 
Management Magazine, April 2004. 

“How to Get Started in a Small Way,” Small 
Business Journey, Small Business Consortium, 
2004. 

Strategic Risk Management Roundtable - Risk 
Management Magazine, October 2004 

“No surprises: Working for better risk reporting,” a 
position paper from The Institute of Chartered 
Accountants in England & Wales, June 2002. 

Micnaei Power, from the bin P. D. Leake Lecture at 
Chartered Accountants’ Hall, June 23, 2004. 

“Risk Management for SMEs,” briefing document 
from The Faculty of Finance and Management of 
The Institute of Chartered Accountants in England 
& Wales, October 2002. 

“Implementing Turnbull - A Boardroom Briefing,” 
Centre for Business Performance London, 2004. 




O) 

c 



(0 

o 

■ MB 

C 



E 

E 

o 

o 



C. Herbert Shivers, PhD, PE, CSP, Tennessee Valley 

Chapter 



Introduction 


C/) 

0 

o 


0 


o 

CO 

2? D) 

E "■§ 

c5 5 


1- 

o 0 

c: JZ 
Q_ ■*-- 

O ^ 
^ O 
c — 
o 0 
o 

0 -h-» 

J? 0 

-Q -Q 
O U) 


(0 
• M 

«- 0 
CO CO 


CO .2 


=J W 

E 2 


oi£ 

g-E . 

g « -o 

E 0 

^ X3 ^ 
CO 0 CO 

£ £ £ 


| £ 
C 0 
-{— ! 

.0 0 


probability of clear PM understanding is necessary 


Risk Management Processes 


V* 

0 

U 

0 

3 

O 


O 

o 

0 

Q. 

O 

Q. 

CO 

"D 

0 

0 

C 

CO 


0 

0 

0 

o 

o 


O 0 

CO ^ 
N 0 


c 

0 

O) 


c 

0 

o 

c 

"U 

c 

0 

“o 
0 cd 

0 

c 

■ MB 

"O 


0 

0 

D 

0 

c 

0 

0 

D 

E 

0 


o 

o 

o 

0 

■ 

0 

0 

0 - 
O C 
O 0 

o -p 


0 

O) 

0 


O) 

0 

c 

0 

E 


C _Q 
0 _ 

- E <9 

(D (D r 
F D) .2 

c to .t=: 

^ C TJ 
W CD "O 

a: E 3 ro 


CO 

o 

■ MMI 

■ wmmm 

o 

0 

Q. 

0 

0 

JQ 

0 

P 

E 

0 

c 

0 

E 

0 


0 

0 

0 

E 

0 

a: 


designed and executed to provide the PM with 
needed data 


What Information Do Program 


0 


0 " 

■o 

a> 

o 


<o 

0 

O) 

0 

c 

0 



(D 

a> 

0 

0 

03 

0 

£ 

0 

O 

c 

0 

£ 

£ 

0 


0 

0 


0 


0 

£ 

"O 


0 


0 


0 

O 

Q. 

C i 

0 r 
Q. 0 

£ - 
o - „ 
o «- 

0 £ 

£ 0 

O ^ 

0 0 
O -C 


0 

o 


0 0 


c~ 

V/ 

-t— ' 

"0 

M— 

o 

O 

0) 

CO 

0 

£ 

0 


0 

0 

c 

c 

■ 

'0 

D 

"D 

_Q 

0 

>* 

CO 

_Q 

CO 

m 

C 

w 

0 

Q. 

> 

X 

■ mm—m 

0 

■D 

CO 

CO 

CO 

CO 

0 

0 

c 

■ 

c 

■ SHI 


£ 0 
0 

0 
£ 
0 


I 0 3 


O 

■O 
0 
0 0 
13 0 


0 

0 


0 

0 


O 

0 


0 — 


£ 

0 


0 

O 

Q. 

0 


trends and factors underlying the business 


How Do Risk Managers Obtain 
the Necessary Information? 


o 


0 

o 

CO 


c 
■ ■■■ 

0 

D 

0 

0 

O 

O 


£ if) 
0 " 


if) 

or 

£ — 
o 

C u. 


0 O 
“O O 

1 c 
>>0 

0 o 


Ec 

o O 

O E 


0 

0 

> 

O 

if) 


0 

N 

■ mmmm 

c 

0 

O) 


O 


0 
M — 

O 

n 

0 


0 O) 

™ 0 
0 )h— » 

0 0 


0 

TO 

0 

0 

c 

0 


O 

Q. 

0 


0 

C 

0 

s 

o 

o 

z § 

CD — 

3 | 

2.o 


JE co C/).E 


if) 

0 

E 

0 

o 

if) 


0 

O 

■ 

'(75 

0 

0 

o 

c 

o 

E 

E 

0 

O 

1 


- Provides for reliable data 

- Simple, with broad employee involvement 



How Should Presentation 
Information be Packaged? 


CO 


0 

0 

JD 

0 

■ 

0 

Q. 

E 

C/) 


0 

x 

0 

C 

O 

o 


0 

o 

7 J 
0 
0 
c 

0 

0 

> 


o 

0 

X 

0 


o 

■ Mi 

c 
0 
(f) 


0 

0 

c 

o 

o 


© s 
T3 "o 

0 © 


0 

0 

o 

X 

0 


"O 

0 

D 

o 

0 

_Q 

O 

0 


O 

O 

O 

0 

> 

o 


0 

1 ■ 
0 


>> 

o 

c 

0 


0 ^ 

E ~ 

0 

0 13 

0 O 
© 

0 c 

0 m 

0 il 
0 * 

0 


0 

0 

D 

3 

o 

0 


0 

N 

■ 

c 

0 

O) 


I 

> 

I 

CO 

0 


O 

c ^ 
o 

£3 C 
0 0 

C 0 

© © 
0 r: 

0 o 
Q. O 


requirements 
Efficient, standard agenda 


How Should Risk Information 

Presented? 
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Timely, accurate, and truthful 
Answer the “next question” 


How Should One Follow Up? 
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